Home / Security

Sorami / Security

Understand the exposure.
Choose the right next step.

Technical testing asks how a system could be compromised. Compliance asks how your organisation manages security.

Explore penetration testing Compliance & advisory

Human-led testing.
Manually verified findings.

  • OSCP-certified testers
  • Written testing boundaries
  • Actionable remediation
Technical testing

Six services. Clear boundaries.

Human-led investigation, manually verified findings and practical remediation. Each service has its own scope, prerequisites and limits.

01

Web applications

Authenticated testing of SaaS products and web applications across your agreed roles.

Explore testing 02

Mobile applications

Security testing for iOS and Android apps, from local data to the backend calls in scope.

Explore testing 03

APIs

REST and GraphQL testing focused on object-level access and token boundaries.

Explore testing 04

Networks

External and internal testing with explicit host ranges and segmentation goals.

Explore testing 05

Cloud environments

Controlled attack-path testing across cloud identities, workloads and data access.

Explore testing 06

AI applications

Testing for AI applications, retrieval systems and agents, focused on data boundaries.

Explore AI security

A buyer asked for testing evidence? Start with the SaaS procurement penetration testing scope. Draft your boundaries with the penetration test scope builder, or check an API first with the OWASP API Security Top 10 self-check. Published fees are on the pricing page.

Compliance & advisory

Six services. No certificate we cannot issue.

Readiness work prepares you for the body that certifies, audits or attests. We are not that body.

ISO 27001 readiness

Clause-by-clause gap report and Statement of Applicability draft.

Explore the service

SOC 2 readiness

Criteria selection, gap report and an auditor-ready evidence index.

Explore the service

GDPR and Privacy Act readiness

Data map, transfer mechanisms and a tested breach process.

Explore the service

vCISO services Australia

A named security owner, a written monthly report and a prioritised roadmap.

Explore the service

Essential Eight assessment and uplift

Control-by-control maturity report against the November 2023 ASD model.

Explore the service

Penetration testing to CREST-aligned methodology

Scoped testing, manual validation and a report structured to a recognised methodology.

Sorami is not a CREST member company. We follow a CREST-aligned methodology. If your procurement requires a CREST member supplier, tell us before you engage.

Explore the service

Australian obligations moved this year. Read about ransomware payment reporting in Australia and the Privacy Act Tranche 2 72-hour breach notice. Privacy obligations sit with GDPR and Privacy Act readiness. Federal suppliers should read the PSPF Direction 002-2026 legacy technology stocktake. For threat priorities see ASD Cyber Action Year 2026 critical actions and advisory AA26-281A explained. Cloud teams aiming at Maturity Level 2 can start with the Essential Eight ML2 guide for AWS and Azure, and read ASD Essentials vs the Essential Eight for what changed on 15 October 2026.

Guides on the decisions that come first

Cloud architecture, security and cost reviews

Questions before you book

Practical answers.

Do we need a penetration test or a readiness assessment?

They answer different questions. A test asks whether a specific system can be broken. A readiness assessment asks whether your organisation can evidence a control to an auditor. If a customer sent a questionnaire, you usually need readiness. If they named a test, you need the test.

Can one engagement cover both?

They are scoped separately and priced separately, because the access, the people and the deliverable all differ. Many teams run readiness first, then test the system the auditor cares about, so the test report becomes evidence.

Will a penetration test get us SOC 2 or ISO 27001?

No. A test produces evidence that supports a control. The certificate comes from an accredited certification body or a licensed CPA firm, and Sorami is neither. We prepare you for them.

How quickly can you start?

Scoping is a 30-minute call and a written scope within one business day. Start dates depend on access readiness rather than our calendar, and access is usually what delays a start.

Let’s scope it

Not sure which kind of help you need?

Tell us what prompted the conversation. We will distinguish testing from engineering or advisory before discussing a scope.

Send an enquiry

Last reviewed: